> I wonder if vscode would still load the script if you click “don’t trust author”

It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.

But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.